{"id":936157,"date":"2026-10-21T22:08:09","date_gmt":"2026-10-21T22:08:09","guid":{"rendered":"https:\/\/www.newsbeep.com\/au\/936157\/"},"modified":"2026-10-21T22:08:09","modified_gmt":"2026-10-21T22:08:09","slug":"php-security-flaws-governments-companies-pull-websites-offline-globally","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/au\/936157\/","title":{"rendered":"PHP security flaws: Governments, companies pull websites offline globally"},"content":{"rendered":"

Australian government websites including that of the country\u2019s own cyber defence agency and the ABS were among hundreds around the world shut down overnight after critical security flaws were found in PHP, a programming language that runs more than two thirds of the internet.<\/p>\n

PHP sits underneath popular web design platforms and applications, so the weaknesses potentially affect a vast range of websites, from online stores and news outlets to government services.<\/p>\n

This story is developing. For updates download our new app<\/a><\/p>\n

Sites pulled offline for urgent security updates ranged from official government portals and local councils, to gaming and commerce platforms, to popular internet forums like Something Awful and notorious message board 4chan.<\/p>\n

Wiz, one of the security firms that found the issues, estimated that PHP runs about 70 per cent of the world\u2019s websites and said the flaws rank \u201camong the most severe vulnerabilities discovered in PHP, and arguably in software history\u201d.<\/p>\n

\u201cIt\u2019s definitely a wake-up call for governments and businesses worldwide,\u201d said Dimitrios Salampasis, Associate Professor of Emerging Technologies and Fintech at Swinburne Business School.<\/p>\n

\u201cThis is a serious flaw in software that can underpin millions of websites and has the potential to expose sensitive information and allow hackers to take control of vulnerable systems.\u201d <\/p>\n

The US National Security Agency (NSA) has advised all organisations using PHP to either patch immediately or pull systems offline.<\/p>\n

\u201cThese vulnerabilities often provide a direct path to the server\u2019s file system or database,\u201d the NSA said in a statement.<\/p>\n

\u201cIf an immediate update is not feasible, it is recommend that organisations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.\u201d<\/p>\n

The US Federal Bureau of Investigation (FBI) Cyber Division urged all organisations using PHP to update immediately and take an inventory of \u201cwhere PHP runs in your environment, prioritising internet-facing systems and vendor products that bundle PHP\u201d.<\/p>\n

\u201cMonitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files,\u201d the FBI said.<\/p>\n

\u201cEnsure appropriate process-monitoring capabilities are in place to help identify potential exploitation.\u201d<\/p>\n

The Australian Signals Directorate (ASD) said, \u201cWe are aware of media reporting about critical vulnerabilities in PHP that may affect all versions from PHP 5 onwards. Organisations and individuals should monitor PHP applications and prepare to update and apply patches.\u201d<\/p>\n

The ASD\u2019s post included a link to \u201cread the full alert\u201d on the agency\u2019s own cyber.gov.au website \u2014 but the website had been taken offline.<\/p>\n

\u201cWe are aware of an outage that may be affecting Government websites, including https:\/\/cyber.gov.au,\u201d the ASD said in a follow up post.<\/p>\n

\u201cOrganisations and individuals using PHP within their environments should monitor and review PHP official guidance, and apply security patches as they become available.\u201d<\/p>\n

Home Affairs Minister Tony Burke has been contacted for comment.<\/p>\n

Attackers could use the security flaws to take over web servers without needing a password. <\/p>\n

Volker Dusch, a security engineer at the PHP Foundation, told The Wall Street Journal it was the most serious problem PHP had faced in more than a decade, comparing it to Heartbleed, a 2014 flaw that set off a worldwide rush to patch.<\/p>\n

The discovery came amid a surge in software security disclosures driven by increasingly powerful AI models, with the number of vulnerabilities found in 2026 on track to roughly double last year\u2019s record total.<\/p>\n

PHP volunteers released a fix on Wednesday.<\/p>\n

\u201cIf you run PHP, it is imperative that you update now,\u201d the PHP Foundation, which funds developers working on the language, said in a blog post<\/a>.<\/p>\n

Security firm Calif found the flaws in August using OpenAI\u2019s GPT-5.6 Sol model, as part of an OpenAI-funded audit of PHP\u2019s code.<\/p>\n

Google-owned Wiz said it found them independently weeks later with help from AI models including Google\u2019s Gemini 4 Argon and GPT-5.6 Sol.<\/p>\n

OpenAI said on X that it considered the bug \u201cone of the most impactful vulnerabilities in recent memory\u201d, adding that it \u201cmarks a new phase, where AI can find security bugs with internet-scale impact\u201d.<\/p>\n

\u201cTo our knowledge, frontier AI found these vulnerabilities before attackers did, opening a Defender\u2019s Window for maintainers and security providers to prepare fixes and protections ahead of disclosure,\u201d the firm wrote<\/a>.<\/p>\n

\u201cAs significant as they are, these bugs are among several significant vulnerabilities we\u2019ve already found and are working to fix, and we expect similar findings to increase sharply in the coming months.\u201d<\/p>\n

Ethan Mollick, a professor at the University of Pennsylvania\u2019s Wharton School who studies AI, said that companies he talks to are struggling to keep up with the pace of patches needed to shield from AI-driven cyberattacks.<\/p>\n

\u201cNow consumers are going to have the same experience of getting everything updated often and fast,\u201d he wrote on X.<\/p>\n

Prof Salampasis said the incident highlighted the danger of ubiquitous \u201cdigital interfaces and digital easiness\u201d, from internet-of-things (IoT) devices to QR-code menu ordering websites.<\/p>\n

\u201cAll of this happened because we wanted [the convenience],\u201d he said.<\/p>\n

\u201cReal-time in digital means there is always the potential for something to go wrong, especially now in times of AI when many of these things can go rogue. The [attack] surface is becoming so big at the moment. There is a massive generation of data on a second or millisecond basis. Everything and anything from businesses to individuals, we\u2019re all potentially hackable.\u201d<\/p>\n

The flaws had been reported privately to PHP\u2019s developers and kept confidential while a fix was prepared.<\/p>\n

Details leaked online on Tuesday, a day before the planned release of the fix, prompting the rush to take sites offline.<\/p>\n

Incredibly, Calif itself contributed to the chaos in a major blunder. <\/p>\n

\u201cAs a result of the leak and pre-announcement around 20:00 UTC, Calif, one of the security firms that had reported the issues mistakenly published a video,\u201d the PHP Foundation said.<\/p>\n

\u201cIt showed their proof of concept working against a number of targets and revealed a few additional, though limited, details about the vulnerabilities. <\/p>\n

\u201cCopies of the deleted video started circulating on social media soon after. <\/p>\n

\u201cThe video contributed to accelerated development of various PoCs (exploitation proof of concepts), which then increased circulation on October 21st.\u201d<\/p>\n

In France, local government websites, including one for Paris police, have been inaccessible since Wednesday afternoon at the request of the French National Cybersecurity Agency, the interior ministry said.<\/p>\n

In the Netherlands, the national digital identity service DigiD, the website of the House of Representatives and the site of the national cybersecurity centre went offline as a precaution, according to Dutch public broadcaster NOS.<\/p>\n

Belgium\u2019s foreign ministry temporarily took its websites offline as a precaution, it said on X, although the Centre for Cybersecurity Belgium had recorded no attacks on Belgian sites.<\/p>\n

Parts of online encyclopedia Wikipedia were inaccessible on Wednesday.<\/p>\n

The Wikimedia Foundation, which runs Wikipedia, said it was addressing the security vulnerabilities and had \u201ctaken down a number of other systems as a precautionary measure until they can be safely patched\u201d.<\/p>\n

Japanese Prime Minister Sanae Takaichi issued an \u201curgent request for everyone to take action tonight\u201d.<\/p>\n

\u201cPlease check if your publicly available websites use PHP, and prepare to apply the fix patch that will be released tonight at 11 PM on October 21 (Japan time) as soon as possible,\u201d she wrote on X.<\/p>\n

\u201cIf it is difficult to apply the fix patch promptly, temporarily suspending websites and similar measures can be considered an effective way to reduce risk.\u201d<\/p>\n

The Australian Bureau of Statistics (ABS) website was also down with a message that it was \u201ccurrently undergoing maintenance\u201d and would be back online on Thursday.<\/p>\n

It wasn\u2019t immediately clear whether the Australian government was given advanced warning. The ASD\u2019s alert suggested it was only \u201caware of media reporting\u201d.<\/p>\n

OpenAI said it had \u201cworked, in collaboration with our partners, to engage with multiple parts of the US government, including the White House\u2019s Super Intelligence Force, the Office of the National Cyber Director (ONCD), the Cybersecurity and Infrastructure Security Agency (CISA), as well as international partners to support that effort\u201d to patch critical systems.<\/p>\n

The AI firm previously came under fire from Prime Minister Anthony Albanese for a months-long delay in notifying Australian authorities of a Medicare data breach<\/a> by a rogue OpenAI agent that occurred in June.<\/p>\n

More to come<\/p>\n

\u00a0\u2014 with AFP<\/p>\n","protected":false},"excerpt":{"rendered":"Australian government websites including that of the country\u2019s own cyber defence agency and the ABS were among hundreds…\n","protected":false},"author":2,"featured_media":936158,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[502905,502846,502903,502910,502850,502865,409614,502869,502878,502847,502902,10968,502886,502858,448248,502860,502915,502877,437592,502941,416358,445311,502885,502859,502900,376769,502873,376511,502921,376855,502853,502925,256,21859,502908,502866,502857,502890,502891,502924,502922,411547,502938,22520,419674,391603,64,2347,63,502933,99,32092,502851,502906,10830,17106,502868,502917,502931,5915,502937,167756,502879,4943,502862,7810,166808,17567,502919,323715,30826,502913,113,502909,502945,4204,502936,502901,38823,502932,381246,25229,502944,502935,502899,5315,45755,151304,502883,1685,29705,502894,502872,413887,502855,502912,130052,502864,502943,5044,207253,502927,502926,502934,6622,502940,427617,12274,114614,502882,502867,502889,502929,502911,5948,502852,502876,502923,425218,502930,427606,285939,502863,502895,8247,502907,502856,502904,153797,502892,55288,502939,384862,412902,502871,329964,502861,391324,313300,434393,394730,502916,502914,35935,384545,470567,502884,502881,502897,502893,393515,502849,377094,502848,502898,502880,103578,385421,502888,502920,502874,385649,54798,27068,502928,502875,502896,34224,4126,502887,502942,31199,502918,502854,113955,41313,29258,502870],"class_list":["post-936157","post","type-post","status-publish","format-standard","has-post-thumbnail","category-business","tag-s-code-google-owned-wiz","tag-s-file-system-or-database","tag-s-gemini-4-argon","tag-s-gpt-5-6-sol-model","tag-s-own-cyber-defence-agency","tag-s-own-cyber-gov-au-website","tag-s-post","tag-s-record-total-php-volunteers","tag-s-websites","tag-s-wharton-school","tag-s-window","tag-10968","tag-a-2014-flaw","tag-a-blog-post-security-firm-calif","tag-a-defender","tag-a-direct-path","tag-a-fix","tag-a-follow-up-post","tag-a-link","tag-a-new-phase","tag-a-password","tag-a-professor","tag-a-programming-language","tag-a-security-engineer","tag-a-serious-flaw","tag-a-statement","tag-a-stunning-security-flaw","tag-a-surge","tag-a-vast-range","tag-a-wake-up-call","tag-a-worldwide-rush","tag-about-70","tag-ai","tag-ai-models","tag-all-organisations","tag-all-versions","tag-an-immediate-update","tag-an-inventory","tag-an-openai-funded-audit","tag-an-outage","tag-appropriate-process-monitoring-capabilities","tag-arguably","tag-around-70","tag-asd","tag-associate-professor","tag-attackers","tag-au","tag-august","tag-australia","tag-australian-government-websites","tag-business","tag-cent","tag-command-shells","tag-comment-attackers","tag-companies","tag-control","tag-critical-security-flaws","tag-critical-vulnerabilities","tag-cyber-division","tag-developers","tag-dimitrios-salampasis","tag-disclosure","tag-either-patch","tag-emerging-technologies","tag-ethan-mollick","tag-fbi","tag-files","tag-fintech","tag-fixes-and-protections","tag-frontier-ai","tag-funds","tag-gaming-and-commerce-platforms","tag-google","tag-government-services-this-story","tag-government-websites","tag-governments","tag-governments-and-businesses","tag-gpt-5-6-sol-openai","tag-hackers","tag-heartbleed","tag-home-affairs-minister-tony-burke","tag-hundreds","tag-increasingly-powerful-ai-models","tag-internet-facing-systems-and-vendor-products","tag-internet-scale-impact","tag-investigation","tag-last-year","tag-local-councils","tag-maintainers-and-security-providers","tag-media","tag-millions","tag-monitor-web-servers","tag-more-specific-guidance","tag-more-than-a-decade","tag-more-than-two-thirds","tag-notorious-message-board-4chan-wiz","tag-nsa","tag-official-government-portals","tag-online-stores-and-news-outlets","tag-openai","tag-organisations","tag-organisations-and-individuals","tag-our-knowledge","tag-our-new-appsites","tag-part","tag-patch-the-discovery","tag-patches","tag-pennsylvania","tag-php","tag-php-5-onwards","tag-php-applications","tag-php-official-guidance","tag-php-processes","tag-php-security-flaws","tag-place","tag-popular-internet-forums","tag-popular-web-design-platforms-and-applications","tag-potential-exploitation","tag-recent-memory","tag-security-bugs","tag-security-patches","tag-sensitive-information","tag-several-significant-vulnerabilities","tag-similar-findings","tag-software","tag-software-history","tag-software-security-disclosures","tag-something-awful","tag-suspicious-activity","tag-swinburne-business-school","tag-systems","tag-that-bundle-php","tag-the-abs","tag-the-agency","tag-the-asd","tag-the-australian-signals-directorate","tag-the-bug","tag-the-coming-months","tag-the-country","tag-the-fbi","tag-the-firm","tag-the-flaws","tag-the-full-alert","tag-the-internet","tag-the-issues","tag-the-language","tag-the-most-impactful-vulnerabilities","tag-the-most-serious-problem","tag-the-most-severe-vulnerabilities","tag-the-nsa","tag-the-number","tag-the-php-foundation","tag-the-potential","tag-the-security-firms","tag-the-security-flaws","tag-the-server","tag-the-system","tag-the-university","tag-the-us-federal-bureau","tag-the-us-national-security-agency","tag-the-weaknesses","tag-the-website","tag-the-world","tag-the-wall-street-journal","tag-their-environments","tag-these-bugs","tag-these-vulnerabilities","tag-track","tag-updates","tag-urgent-security-updates","tag-volker-dusch","tag-vulnerabilities","tag-vulnerable-systems","tag-web-servers","tag-websites","tag-wednesday","tag-weeks","tag-your-environment"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts\/936157","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/comments?post=936157"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/posts\/936157\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/media\/936158"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/media?parent=936157"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/categories?post=936157"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/au\/wp-json\/wp\/v2\/tags?post=936157"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}